CVE-2023-0818: 
NixOS vulnerability analysis and mitigation

CVE-2023-0818 is an off-by-one error vulnerability discovered in the GitHub repository gpac/gpac affecting versions prior to v2.3.0-DEV. The vulnerability was disclosed on February 13, 2023, and impacts the GPAC multimedia framework (NVD).

The vulnerability is classified as an off-by-one error (CWE-193). It received a CVSS v3.1 base score of 5.5 (MEDIUM) from NIST with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. However, huntr.dev assessed it with a higher CVSS score of 7.1 (HIGH) with vector string CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N (NVD).

Based on the CVSS scores and vectors, the vulnerability requires local access and user interaction to exploit. The potential impact varies according to different assessments, with NIST indicating high availability impact but no confidentiality or integrity impact, while huntr.dev suggests high confidentiality and integrity impact but no availability impact (NVD).

A fix has been released in version v2.3.0-DEV of gpac. For Debian systems, the vulnerability has been addressed in version 1.0.1+dfsg1-4+deb11u2 for the stable distribution (bullseye) (Debian Advisory).